MalwareBazaar

Overview

MalwareBazaar (by abuse.ch) is a community malware sample database — search samples by hash/tag, download files, and submit new samples. The API is POST-based.

⚠️ Breaking change (verified 2026-08): API requests now return HTTP 401 “Unauthorized” — an API key is required (the anonymous tier was removed). Register at bazaar.abuse.ch and use the key from your profile.

Quick Start

Register at bazaar.abuse.ch for a key, then (replace YOUR_KEY):

curl -X POST "https://mb-api.abuse.ch/api/v1/" \
  -H "Auth-Key: YOUR_KEY" \
  -d "query=get_info&hash=094fd325049b8bc9b68487eb975bcf9f"

{
  "query_status": "hash_not_found",
  "data": []
}

Search by tag:

curl -X POST "https://mb-api.abuse.ch/api/v1/" \
  -H "Auth-Key: YOUR_KEY" \
  -d "query=get_taginfo&tag=TrickBot&limit=5"

Authentication

• Register at bazaar.abuse.ch → your API key is on your profile page.
• Send it as the Auth-Key header (missing/invalid → 401, verified).
• All queries are POST to /api/v1/ with form data.

Rate Limits & Notes

• Per-user rate limits apply (see docs) — keys are free.
• Queries: get_info (by hash), get_taginfo, get_siginfo, get_recent, plus sample download and submission.
• query_status in the response tells you the result.
• Great for IOC enrichment and malware research.

FAQ

Is MalwareBazaar free? The API is free but now requires an API key (401 without, verified).

How do I get a key? Register at bazaar.abuse.ch — the key is on your profile.

What’s the query format? POST form data with query= + parameters.